autoconfig[.]booksy[.]store

This domain is flagged as an elevated-risk phishing site specifically targeting OVH webmail credentials. Analysis indicates the infrastructure was designed to impersonate legitimate OVHcloud email access portals, a tactic commonly used to harvest login credentials for subsequent account compromise or lateral movement within cloud environments.

Infrastructure analysis reveals the domain was registered through OVH on February 21, 2026, and resolved to IP address 213.186.33.5. It appears on three security blocklists and is detected by 6 out of 95 security vendors on VirusTotal. The Gridinsoft trust score for this domain is 0/100, and it is actively blocked by multiple security frameworks, including MetaMask, SEAL, and PhishDestroy. The page title, "Webmail: access your OVH emails on ovhcloud.com | OVHcloud UK," further confirms the intent to deceive users into entering credentials on a fraudulent interface.

Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address (213.186.33.5) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response (EDR) systems, email gateways, and web proxies. Users who may have interacted with the domain should be instructed to reset OVHcloud credentials from a verified, non-compromised device. Additionally, organizations should monitor for unauthorized access attempts or anomalous login activity originating from internal networks, particularly targeting cloud-based email services.